[Webkit-unassigned] [Bug 143345] New: cloop overflow test is broken in recent clang

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=143345

            Bug ID: 143345
           Summary: cloop overflow test is broken in recent clang
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: rjogrady at google.com

cloop.rb's cloopAddOverflowTest() uses this check: "((#{signBit}(b) != #{signBit}(a)) && (#{signBit}(b-a) == #{signBit}(a)))" to detect overflow, and similarly for subtraction.

In clang r221045, an optimization was introduced which breaks this for the case where we are incrementing a value by 1.

Repro on Linux (with clang r221045 or above):

$ CC=clang
$ CXX=clang
$ build-jsc --cloop --release --gtk

Then execute this in jsc: 
for (var i = 0x7fffffff; i < 0x80000000; i++) {print(i);}

Notice that i wraps around to become negative.

Using safeAdd() and safeSub() from CheckedArithmetic.h avoids the problem.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150402/08ca73ef/attachment.html>